Type of Authentication

If you want to authenticate to a form on the web application you need to supply username and password credentials. Form authentication typically passes the username and password within a POST to the application framework. If the application framework is on the same domain, use the Standard Login option. If the application framework handling the authentication is on another domain, you must provide crawl access to this domain via the "Explicit URLs to Crawl" setting within your web application settings.

These types of form authentication are supported:

- HTML form-based authentication (standard login)

- Custom form fields. For details, see Custom Authentication.

- Selenium script uploaded from your file system

Use these guidelines to decide which form authentication type to select in your authentication record.

Standard Login - We crawl the web application, detect the login forms, and submit the configured username and password into the fields that we discovered.

Select Standard Login when:

- The application has a conventional login on a single HTML form, with a username field and a password field.

- The crawler can reach the form, and the form submits normally using a standard POST without heavy JavaScript.

Do not select Standard Login when the login is not a simple pair of fields, when it needs extra hidden or token fields that you must control, or when it needs multiple steps or client-side scripting.

Custom Login - You specify the Login URL and the exact list of field names and values to submit, and optionally a custom submit element. We submit exactly those fields to that URL instead of relying on the field names that we detect.

Select Custom Login when:

- The login form needs more than a username and a password, such as extra fields, hidden parameters, or non-standard field names.

- You want to specify the exact action URL, the exact set of fields to submit, or a submit control that is not obvious.

Do not select Custom Login when the login requires a complex structure, such as multiple steps, Single Sign-On (SSO) redirects, a single-page application, multi-factor authentication (MFA) or CAPTCHA interaction, or a lot of client-side state. For details, see Custom Authentication.

Selenium Script - You record a full browser interaction, and we replay it to perform the authentication. Select this option when the login workflow is too complex for Standard Login or Custom Login, because it is not a single form POST. See Form Authentication using Selenium below.

Standard Login and Custom Login both require the scan to find the authentication form and report it under QID 150115. If the authentication form is not reported under QID 150115, Standard Login and Custom Login are not supported for the scan, and you must authenticate using a Selenium script.

For a list of all the authentication-related QIDs, see Authentication-related QIDs.

For more complex form authentication use the Selenium Script option. Record the authentication process in a Selenium script and upload the script to your authentication record. At scan time we'll play back the script to authenticate to the form.

Select the Selenium Script option in these cases:

- The login workflow is complex, for example, multi-step authentication, static CAPTCHA, or static OTP/TOTP handling.

- The login page is JavaScript-heavy.

- The authentication flow requires redirection to multiple pages, as with Single Sign-On (SSO) or OAuth2 redirects.

- The application is a single-page application, for example, React or Angular.

- The login form uses dynamic fields or anti-automation fields.

- Standard Login or Custom Login do not work for the web application.

For details, see Use Selenium Script.

For server authentication you'll need to provide server authentication credentials within a Server Record. Server authentication is handled within the HTTP headers. Selenium scripts cannot be configured to do server authentication.

These types of server authentication are supported:

- Basic

- Digest

- NTLM

Use server authentication when the web application requires you to provide server credentials before it allows you to view the application.

The web server determines which type of server authentication to use. Configure the record type that matches the WWW-Authenticate challenge from the target server. Find out which type the server supports, and then select the matching record type. You can use the browser developer tools to see which type of authentication the server requests for the application that you want to scan.

You usually configure server authentication along with the form authentication in the same authentication record. If the server authentication succeeds but the form authentication fails, the scan authentication status is Partial. For details, see Authentication FAQs.

To add a server record and enter the realm and credentials for each type, see Authentication - Server Records.

If you want to authenticate Swagger/Open API file using OAuth2, you will need to select one of the four OAuth2 grant types. Select a grant type and enter the details to create an OAuth2 authentication record. We will use this record to authenticate your  Swagger/Open API file at the time of scanning.

These grant types are supported:

- Authorization Code

- Implicit

- Client Credentials

- Resource Owner Password Credentials

Selecting "Authorization Code" or "Implicit" grant types requires you to upload a valid Selenium script. Record the authentication process in a Selenium script and upload the script to your authentication record. At scan time we'll play back the script to authenticate to the API server.

For details, see Use Selenium Script.